<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="333">
<package pkgid="6715da9b5f0863a82e34c39af846fbfb86e660fcb95524b226c60eef4c430a97" name="flightctl" arch="src">
  <version epoch="0" ver="0.10.0~main~81~g6efe8999" rel="1.20250812173346517456.main.81.g6efe8999.fc43"/>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.0.1-5" date="1724241600">- Add must-gather script to provide a simple mechanism to collect agent debug</changelog>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.3.0-1" date="1730721600">- Move the Release field to -1 so we avoid auto generating packages
  with -5 all the time.</changelog>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.4.0-1" date="1738929600">- Add selinux support for console pty access</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-1" date="1743422400">- Add services sub-package for installation of containerized flightctl services</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.6.0-2" date="1743681600">- Add sos report plugin support</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.10.0~main~81~g6efe8999-1.20250812173346517456.main.81.g6efe8999" date="1755000000">- EDM-1992: Agent SystemInfo smart collection (#1526) (kkyrazis)
- EDM-1476: add Events validation TCs (amalykhi)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-1821: test pass (Asaf Ben Natan)
- EDM-1821: added monitoring validation (Asaf Ben Natan)
- EDM-1993: Add restart configuration and polling for generated certificate files (Dakota Crowder)
- NO-ISSUE: publisher: call stop() before wg.Done() to fix flaky cancellation test (#1524) (Ilya)
- NO-ISSUE: Fix broken link in docs (Avishay Traeger)
- EDM-1987: Disallow label updates for owned fleets (Avishay Traeger)
- EDM-1712: fixed stuff based on PR reviews (Asaf Ben Natan)
- EDM-1712: Migrate HTTP metrics to OTEL (#1489) (Siddarth Royapally)
- EDM-1712: added tests renamed to domain metrics (asafbss)
- EDM-1845: signer refactoring: avoid parsing CSR multiple times, decouple from API layer (Ilya)
- EDM-1938: agent/dependency: ensure partial layer pull cleanup (Sam Batschelet)
- EDM-1818: Prefetch Manager Config Docs (#1514) (kkyrazis)
- EDM-1058: docs/user: add TPM related docs (Sam Batschelet)
- EDM-1058: internal/agent: small TPM api update (Sam Batschelet)
- EDM-1058: internal/service: refactor TPM csr logic (Sam Batschelet)
- EDM-1058: internal/tpm: ensure chain validaition (Sam Batschelet)
- NO-ISSUE: Event fixes (Avishay Traeger)
- EDM-1170: Fix Makefile (#1490) (Siddarth Royapally)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-1946: labels endpoint with field-selector=metadata.labels returns error 400 (#1495) (noga-magen)
- EDM-1058: internal/tpm: ensure conditions are maintained during approval (Sam Batschelet)
- EDM-1058: Fix simulator tests and flush key bug (Kyle Kyrazis)
- EDM-1058: Testing TPM Ownership Auth (Kyle Kyrazis)
- EDM-1058: Implement TPM-rooted device identities (Sam Batschelet)
- EDM-1869: Add missing events (Avishay Traeger)
- NO-ISSUE: reverting EDM-1871 (noga-magen)
- EDM-626: Add Git support for test harness (#1328) (Siddarth Royapally)
- EDM-1958: Fix Device UpdateStatus event panics (#1482) (kkyrazis)
- NO-ISSUE: Add io.openshift.tags to db-setup container (#1486) (Assaf Albo)
- EDM-1170: Auto-discover VM IP for agent updates (#1393) (Siddarth Royapally)
- EDM-1845: middleware agent cert OrgID support (#1471) (Ilya)
- NO-ISSUE: no need to keep rpms in gh-pages (#1477) (Gregory Shilin)
- EDM-1952: Add middlewares alertmanager proxy (Avishay Traeger)
- EDM-1838: deny DELETE ER  when device exists (#1415) (Ilya)
- NO-ISSUE: fix version generation for COPR for release (#1468) (Gregory Shilin)
- EDM-1944: setting Enforcing selinux in microshift registartion E2E test (sserafin)
- EDM-1942: Redact passwords when config is logged (Dakota Crowder)
- EDM-1936: Fix Router group order to make auth/validate reachable (rawagner)
- EDM-1846: orgs cli support (#1424) (Ilya)
- NO-ISSUE: Add VM_DISK_SIZE_INC to set the disk size increment in vm (Itzik Brown)
- EDM-1766: Small SELinux Related Tweaks (Ben Keith)</changelog>
</package>
<package pkgid="d1035e54282ee877ac9cc5ec8e28366d8d0bc623092a9b938f653121ea920fe9" name="flightctl" arch="src">
  <version epoch="0" ver="1.2.0~main~27~gb5c1b040" rel="1.20260204153358102810.main.27.gb5c1b040.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.2.0~main~27~gb5c1b040-1.20260204153358102810.main.27.gb5c1b040" date="1770206400">- NO-ISSUE: missing network policy for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Bump resourcesync e2e task timeout value (Dakota Crowder)
- NO-ISSUE: Add e2e harness setup without VMs and use for ResourceSync tests (Dakota Crowder)
- EDM-3265: build cs9 microshift image only if the repo is accessible (Ilya Skornyakov)
- EDM-3262: fixed cancel not working properly for pending states (Asaf Ben Natan)
- EDM-3263: when defaulting to HOST_FQDN -&gt; lowercase it (Asaf Ben Natan)
- EDM-3005: update ginkgo_total_nodes (Gregory Shilin)
- EDM-3005: update ginkgo_total_nodes to be 2 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Add cs10-specific error message support (Gregory Shilin)
- EDM-3005: Add running cs10-bootc e2e tests. Fix certificate handling (Gregory Shilin)
- NO-ISSUE: Disable rollback test temporarily (Ilya Skornyakov)
- NO-ISSUE: imagebuild api set to v1alpha1 (Asaf Ben Natan)
- EDM-3258: EDM-3257,operator cant cancel fix (Asaf Ben Natan)
- NO-ISSUE: fix Publish Binaries workflow (Ilya Skornyakov)
- EDM-2985: fix imports post-merge (Ilya Skornyakov)
- EDM-2985: add unit tests (Ilya Skornyakov)
- EDM-2985: validate header value (Ilya Skornyakov)
- EDM-2985: Add API version to HTTP request logs (Ilya Skornyakov)
- NO-ISSUE: repo url + entitlements support (Asaf Ben Natan)
- NO-ISSUE: Updated init container quadlet files to ensure everything in standardoutput and standarderror shows up in journal (Ram)
- NO-ISSUE: Add TC ID 87279 to greenboot rollback test (amalykhi)
- EDM-2636: Rootless Quadlets (Ben Keith)
- EDM-3226: fixes invalid chars attempted to be saved to psql (Asaf Ben Natan)
- EDM-6163: Skip kind test (Eldar Weiss)
- NO-ISSUE: MVC separation (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ac6180cf109534236c676b635fc5bd91996c75ef4c1a666f9df7e208a5348566" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b206d4bf2537302462eec04d1b2189134b169bc09793b6d78d17846ad32ed382" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="42bee2e3886e41e539980dba75847292c1d0f75d73336b6dfa0f3fe73f821fef" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2d5ec7b1a2660e59c0a79b7c4d74684bce6620943253017b0ac1b3a82cc8b989" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="603ec7c21808b00c0fd9e56debde0780c5cb7b3f2889feba75c52f681bccb5de" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f68965b30be50d792a31613dda3759baf3c2d2ba232b5a8eee9303ac2154dcc3" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fb4fe57b0b79ca07ece10881a2936edb17a1ed93b49a8ae11d530a85b8a95982" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c690ab5c5952866a607d5fc0dcd215c9e5c63f32cabb5ce59ad58427f47c6203" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ce9f98dd1e7fc8bd5d2f2cffca298c541433c0feac299d130fc4b84ae4dbf452" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d01008aa11232754395ced019b60899f58270ecce9ba23f9b08ffbda00b6f3f1" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ec415b3742806b5cb72cf8d955633c8e0c55693f684a15f56272b76bd9cafb15" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6d6271eb2e78299b94d35ca18fc4ead8fe92e02da90a789c4cfef299ce3062b3" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eb6ce0b975fa6e08ee7628241ad7ec9739b11fab2ed5fb2f16e141d5c3171633" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7507d53ca439046250928f12178eaa75e84cf56feee667d70805de823b82523d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="30ac39708620cb97eec017a4434d2dc3d05b67469290d49986d74ed1d3605fd7" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="23f9b37fa382731bf574cbe8f9587cb89be945ae5f8e252df7a1d0a4d6bac95c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7e7f3c37a07512c29b3d2b813eb5533157cbe592d3955abd1972273e1a13c3f7" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="309934f2d4531f242d5c95a0774717ddbec8e8d03675a6c9b1d98dcd802ae4e4" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="84fd320002dc65ac2c33ae2d0528a91e6654f24ddd3e61cd0ed355ad01b05189" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a04a3823feea9bbc3141a73ba61a075737310f13c22b5b230e6932d6d852747f" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="86af8d353e78414c5453585787df7e8cfda18925bc56aa75a5f57c3669ca0493" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3ae3e38700fd0c44c0e4f75aebdadb0b85098ca93bef7f3b373876c03702c716" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cd72d62c4058220abac83efb28c79770f39baee80570104f4593fbd8e844b41c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a5d7488ce05a3fc2c8db90da8a2fadda53a556ec15c74566aaa7a0ed21d25fc0" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3cf71c9da8f91ab0bbed7b6b030b0bcb61573d42ee33ff58394b5f1365fa4ad4" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1ea846e8c6275b1464cafa70d18ef7f9cfb43a71d97467a243ae584e42eef17b" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="57f37aa8c1cb0d35d473f0e83ddec75810d2a297c5cf66deab5e2234bd1268b2" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="33552f549acaaf2c4d6101963617bfc47ca020c1f6348b9ca8f1eb6ebed78225" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9b80ede78ca021eb88cf23212c19dff68d5f2a81540856d5ae9774d51ec58299" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="94e407249a305bf0cd15a6d0fb35b07b597a099b0f133024467920f646e167cf" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d356e74a47e65d0e4ac129ba1016addb2dab0cb82a965583675e5fc6c68d7323" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2aac2d40ce8f3e9191f2cf65ba1fd1a3d4a1830833699c16e4e7049235da44cc" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e4dd30f904e5913f79dc35951a81ccacb9957bd341b4ec5d3dffbaee420e98ab" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9c0fa8642da78df25e7bb975c64e14c8e9a1230862760a7439a45ca1583258ec" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="359806bae1af8d89cb0ab0fdf242193ba0148f9fd14aa7e22ab9fceb01223f20" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b18c52c308551ce8deeeb4951477ec17f364b8a8d924bc7056e2c6feef73a5b9" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e335610eea4d8119713135d6713a775505020f32cfa83b06652581db7144792f" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4a23b36b8fa8c6d244ab1065208f7788a0a73b3550f10af271aad059067399c9" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f14d30c93675281cf7eec3fabbe3167e4a4a4b22d1fd6813996771b55db3a5da" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cb1ea17851720a3e44153efedb984c743722f0e41d7e78de013feb065de0978d" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d27d98733d753811934cdef6562666f48224c06c2adf323fb84c5f476895d528" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="48155df7bf9b53fd9081b8d10100db139d0f34882463167a943bf303dd4c6a2c" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f2aa1e7e3f08cfdb8e32d21bf61bca6d2cd004ede8b967e3390023ce85f291ec" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="498009331abe1c5bfb3e152552afdae995675dc4ec48bf4c1bd102cacd20386e" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="062c3077afdffa73b924b75fd8bc1af821b8d8aed526f0fa3016945a35b47afb" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="78994ac9ac573bef492c0eed744e6e22fd45a53f9bf64a5c76cf30493c0ae317" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2149c36335febedfa4c9a9af03bedac33f509bbda58cc816ac7b182c8a45084e" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8ff85a56f8a1adfb9b3a35a4c95726f5fe46c66d05ea77766788f3308aef75d7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="beb4b923705db6991fd30236bda5f488e582a14d95d7dc571c493c59177cac5a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9c80f82679975e1f6c45bb5581b3d9bf364816e1f266b4e4e90f402ebf81b9b0" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c09170dda638086571358229742abc2e44daf4c8b4f03ac1cd9cff91411e8542" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="70caeb7270d1df5bc97d7545a3fd3151dfa898d6fabdbf4027f43aff34b91811" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="44245619ccf2b96ed98af14b07253d937afc5120f5ba530f79d9d680a84b39b6" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e906c6ef43f4ebfeed0a96ef9e52f3f12dafbe56d3218560b774ae4023849f75" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e60b989c8fd13595c0845cc2d444bde18e3a9f229cac418aac4d3b0afde79235" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="76bcfa4ba7423d4b3f6ec0ad3e0e07674ff222a9d70ebb05f217d7ecd2bc975a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ecccca8a30c06f5ef10fc088dbd734445e442414c7e006ddb3f36813171fb6b0" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="41ac2b63bdfa38ee3cf969c606af3232b5b24cfdcc2becce9569c8c0f090e414" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="36546841b171fe48ef028aa935b5e82b04df9597684c1e67f7fccebfb18865a3" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f8351f82e5e0c3310e1550bd0d8911dfd10953cf2e86c18734801973ffd728f7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4672be04facfe6c91ae21bc8ec12cc1ea23521a27b1bc9e05949cecc885b3a33" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7f4719db537c7778aeffc21c2560b529cdfb203cfd6c5f0d51b26c3d666bc20e" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4f46675c37e054f7970cac35dbc7ede6be6809e3a389f4b695710755a74c11dd" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e815995039a76e05a24aabe660c5069218e24ab03e55a8cc5e95c651fce49539" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6578db4111a876885a4d88c9f97ed40f00126edc7db424264c30d06e71d0d255" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="944826215ae46d157ceb78883d8507c68bf95e8940a6f431c2d65fe5ef0a85ab" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8fe466b5eae7dcf98fbdec7f94192ab6d50938a30c4c75d1463d422ed95a537c" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b35abcb5b9d14f67a0f42807d0b11514fa71c5586606374384abe1d0ea8e17b0" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="672b60f7fc82eb533c2c163ef834cce821e898d0f194909119d1b9a13c5162f9" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3f42c37e862f43d6301f492f97572ec9a19326126ae657dab72bd14914718aec" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d9fd56d5fa70094e153a0f6d6642cc39d12afbdc0c04acf6b9525454c61a3e70" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b68f7a37b739adf7ee524a742b71e4b2963fd65138fc0ef5d4d3b1b0f473443a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3e899eb9c17908a7ba27c3fffa3b6d3cef64d3c1daf5abba0888fc5933d06492" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d9471fc47b4a106e4497bfa00dee50bdbd91a95e6b4afd05afcdb7fd2b257453" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="18773be64a071a7c0510ff2a0300153759336860e407ba700aad60fe2eea28e5" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e2ccb25854a6fb635aaff4d6ab64e06ec16986231f12a967e8b4006005a4eb8e" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b081715371e907b3567299e7d62b2b6273c51b460f7bf21e8905872f6799d7d4" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2c827f815995d830b2fa6bfe9170b61ed2c293ad6af35cc33deb05481d7590ff" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9f11f648b06098d27c907a825de3c84791f430dc2aee5e99705a039c3ec520bc" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="19a66b2e534e028abd9f8bbdca591a331f343c0576c78dcb8ba5ce3aae01f11c" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="95aa2de7ee7e2a53feb7e7f8644a5e214197557f08f88bac76abee0cb52d1af7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="340025376f4a2329064e034247aec4df6674dbc261ee977aa76242c1da7f7b11" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="634384dcad8ca2eba0223cc3fdf16aa1cf610bf28760ea89f8e7f6632ff4d9b2" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="27e307ab821fea140cc7b28b91e6b9978f497aaf462c83e052657caad5aaf2e3" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cfa6fec9d09180aa6ba2a0cd9970dc02a52b7c81dda7296a5b4d18cf415f5e87" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="01d9577ff37252d02ec85f61dd48e674d67db3953fbe555aa5fbfaa0ff900e63" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="09977113ff2fc99d9f5914ca241027d4133c8f64960cfc7057e573acb9a74636" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9fa65379de60729a1993948113bd5c45b98f50133664aa32fa708e226b75b4d5" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f8d611e853ae64f0cc31e2eaea8a7810122fd724b1e39f1ac7c0dd859dbb91a7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="064b0b7a44d40d033af19cc1944fe0a44010e1544b4e9cf1b529a167297fc688" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="61b4f2918ee6403bdad8ff7fccb6312dca65e739cac60e0b1a23cf5dbae6d2d2" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a3c1dca41dea34b9610819cb15e5266c189dead3b7d52cc6bc515026d70841d9" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6c1770f43ffb3e7fe892ba02c4afa241ab4c6a6f63d74e36b74638b4b46f76ee" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f3337f462ac17aeed52122f31bde5a2137f1b01163d7d27eec261da34116c04b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="79b33660c810a116c216a7d59ab4c14457f760fff84d76b1c5b415441cf93825" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="519aba53d6966548c7d0d4e56754a2e8310d82bc222c98c26ad30a1f89bd97bd" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="21de3ff2db37149e4b06d47c79f0bd23649f58a3dbdb5658e673e183952f098f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="87973ca4b74affc0751044840a1688fa834dd76ed5de6405faa2fbb589902c91" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="89dd9350fc821357ae8ee3cfb73a5f51d4c659e1fec6197c1f30c1baeb49bc3d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="edd6d66866d2118d5511a90c9d88b2ebbbebf43778d1066728819620d94aab63" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f8b9749bc49813c8cd411c24614eac8c8a86de6a86c634a4f195d8ed267ab802" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="36015c426dbcc0c184c3875426473281226391c31921ca3002b6e91023dff792" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="57b27fdcaeea273e13337740bd1ae2e00efeed077e69d3cb3bd52b33243a5006" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5af61d3e6085a0f548cd1abf7061d273839e9fbc8721ac8b645c0acf5ba13d32" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1a0d047416af6ef852f85ab44c61cc7262c6bd596bf654baa6a297a1061f0aed" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="aef8c6c7d2bb80bdb4740995bc6f52a3ccab201e35867b89018e7748cd39cf60" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="56d7ff53ab2c85c512a34b74a1dd2731bdfeb2acffe41c7425e78379b36a4610" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e3875e27ea12f77205261b88fd7206633624d77eeebb7f2912f1214ac776cd40" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="090a261f5c09c9ea33f4b8f2e9ca2efd186c0080417ee7ef19dae6d4d8396210" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5dbd4a393c31433d21d31896072e16df678d6817181780f2dd4495c3cdb3099f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ba9d0cf22f4573abc72fa81a7afec97e24e7c8517ef1acd4f132b119e94f6351" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="305710d849cdb8606511fb3a70ef93f052db7f5b6bcff3647368288592294a9e" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1c4d1284f1b04c68018af88a1026a08f4c8fa07925c2d14abf5598db389a12b4" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c8212577089781f598d1f5b4fe9884024e10cd82bf6c2ab5f3d1bb393c7f41d6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d73511a4294127509c9b7322183d7b4aac32a85600b248c5a40d98ce9dc33480" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="820218e9495fb065a6662433d2a89242bcd2f0375ff15ed640bfff80cd669dc0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cb726aa1bec2dce81f28ac86139adbacc449ef85c73b87b01a0acc2e4cabbd63" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="92e4bd1c629f8d5f0d81d604563851e415e22638d01d248081f7254a54f0026d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="66476b21234fc27eca0914bbd1239a83585c4366aed1ae462660c5e5c9433b63" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="934ce0e30e4e95a002d0d6f0caf94f94db185aec4f7a6ebca640e31a5d470dc6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="68f5c55f6e09f37eb06ceeddcdfc72eb9d37a4f012fe2e7d908d5be5f316ff6a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4b38231bcd3eed01e219493f76260cd66de4af62052162240333c01b7514ed0d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="532c2a66fcbf190791344f3f76063d0a2ad8ab83ed478f038540749cda30663a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4ac10be24deea0a7a090ca202a60de784ef74d6caab4f60686e80661be6db075" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8b121225568e5a939f4b660ddcb664ac9408e72af9793630e1cdb4715c55dd54" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d73116b2b3e32eb32f1648a804182730fec12b3702a18334942ccc56993ad0b9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ccc1e1562b074504bef0d88d338fb5d5bf112036f578c200cc8c743e4a05310a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="287ccbb9c5b620473f4c82388c76e86f7fba450e1e78b723f802decba02159d1" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2bb18fa92e3788a9e6180da022a58b078b8a785e9321666ac9a8936e5dbae216" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="03ab82766f890e76d575f51bc01e62629ebb9e0fbb41cb71abd12e4781912cba" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cfaed4d4ec0c86480b939b974a1c28c17e296a92776cfe0329b12f829b6159a5" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2e5197fae23daa67cc0bbf06fa54218cc6c800da019c74e28c53842bfa47bb83" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="35eb8c4fbd6bf46f599e428a04c173f89aa56aad6f57ebdb3d6f649d6f816a6f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="adcd40356408a9ea109827abdf96cceb180e58185d1ed2099eade9e26d94f0e9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f2af0cd8c766722db9c8505fb183ced638183394a4ee960ff87154622b78426c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9c35f8cd97565b7aab68b86d5469111e2675f8e1198c0e103d77e5ead59ea515" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0932515db2fc28510d0fba27e7362779da389ef0d3b20d592a85017d06ef9979" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6f16eb4733460c8d86aaa1b1d1bab3c8bf73b1bef6ada8234b9d788a604b6b45" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="502b48f7a9ea309bbc347beeda55d3aed49ecd8f552a4ea85f03e637d81f91b6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="74e41adacc25766006b31d26c540e9a5fe7595b39eb1e6ada1b38dec527cd0e0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="50a3168a8156c7d377e1a33d5440b08b2b3e5b6bd8380654b1071d32e9a849eb" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2105252646a5a0623952f8450507e1304838cf781023b8bdd0377af7689530c9" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="75a9e78800a4516176f838ebd68235ae947067a01031e76fa10e57a4943769da" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5b22091491ac4725adcc827bb25d5ab30d636d26695af62491e28206feb419f3" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6b524dbb44695c964f492d9f3608681fa8cd6248b54ba49bf5e9807ad95329ee" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="70a99a7caf431719f15431194ac9e9d94dd097a86e8f5429e121dd32cf818920" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d07150010779dc6a053c8c11a31779763033a84fdad36db67a345e43d20edc05" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="19eee0981bffe9418c7b73b4dd1cdea658c94607b87129669c1f54c018fe3b0a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e8c9217ea9aff017bb92bb113944233b3c6f525205228a5866feb810d7ca2005" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3921f1df898d72e6f6f629c99326350454817686830a7a9332d8b6bbe72ec5bd" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="96ce7b40df1846549cc237885d79fdd78f3f30741b0de5109ef64b7a4c7ce25a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ab2d0b649e81c4adbe97ad300d5c868df478bf221e9725170ccfcbee1ecdd61c" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="416069091efc3d6c644867ca58e386f8faaa187dc1428da07625594d37ec925d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4c6ba0c72a1606ffadd2390740a85dbab01530a37f026609dda25340850987b7" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="36d3cc556f0348c81d83a9a49612aa56edd2b0e5806edbfa2994f782c5a0c30f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9c3e35c91946a4aff48a306457c4df937d5f1a16a6fa695d161098f0a3e79ac4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="da72e3c5d7545a68096262db86cf62852222523a9a0742fc17fa81c7f0d6c6d4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1a480a3dc8a1b5186eb27bc586ac0aae842664029ac91be94c1eefdd318ff147" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7696d488911d493cad3ea3adc3f13669c728a8385e6d8ce0fc9e719f35c015c5" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="edbb194b83e93150a234144cf4044820d8e0df085496234fbf1b830a0ef4729a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="76c19d909b728f09a41ad7cc14eb0a07505d12868ea06b48a1944f209e1c417e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ebbff65a44cd867050dcd3c367d7eecefc1c5e13c2b9c87f05ec365e8c2a5e05" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a9ee435fb20b4e113343bda04d3b9c8feab43fa08badcd99b7bb9bf6c27853bd" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5724b13d8f82c35df10f6579fc830f7e517351c7d67869f8530f00ce88c90b87" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b88c6adc23c99c35b0b73d4e1159178a2c5cd5347536e5336cf8a803254766b5" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6072c9e5000dee4b0b95f03c82f9b7b41f00e5ac51653da830254ab4977c5cbb" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5989e5f6673919b26923c6b59bdb9483b417f727588c033dab1f2474bc0aa08c" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9d7035c98871380a19b2067a3e1140589aadcdb04a5ec181ca06a95a186be8cf" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="289fe71502bb0d11d0c6536a74012f3819e21ae51c85928d23ae94f45a0f9cfe" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="32170626310f7c6b8afc1a09c5d7f350d859d666bd5de9848bab1c5df8282ae4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="350a828d57e5a62a5131246c188dc8400a33366d8210ee1d8f8c590023af8590" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eb4c7997b27d42fb79b419a0ad53c0c44242067906cf6fcd4b937e61ff08e36f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8ea61e5ac9102031d486f2c87e704a643e4171c127dc9e2a32c6c7e49198685d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4d578a5a91c9bd9c7d7c6bfbcdc53e6186f8066bf1c5a80e1a14b9da4973e9ab" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a803cc20a602bc140a3c67008b91c80a777cf0d546ab6563af268708f898eb80" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="612d01ac875a35751ff57b8799e8819334e7a61aa8d506bc791828f03754ffb7" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="041612b3f2e76ca0ca99fafffedbf3617fccf680950b4a380a24bbcd5d37c844" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3231a5bfd70958185aeecb87157138904cbde63b830420222fa28a3b95bdbefe" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="fe921b8045371ccc49f054f0686271a923a9c1d2096419fe3830e99ec5f1b53f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="fed9afca6b09b0c181f15a1a6d689cb616e340312f9b7f91d493920334078d85" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a9dfe72f0a36ed85572b9a60703db823d698db7a686060896c19576bffc38b5d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="80d41426eead6327e93f944b296e4da230ea01bc1b536eb50848ac81cc819bd4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="de29099347572b64099e385aa52fcece008101d6e57f920f3e22b0180a597f75" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="da521dc8f7e22317b222baf8d3abeb2099858451142903a38d48790bbd97f877" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="29b260e614224e78afc501c4f918a4197f832518b3714550b5b8bb7deaf6bab8" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4b451e7799edc45fc65bbb42e9449cee97c9b75f75413bf9dd39230d774c3604" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5cde8dbf0be9d70a5bb59e3958997f7bf9a68c8a2775ff00f2a51d6f2df068f3" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="7dab55e9e92ce868fa0c5f8aecab3acfff42d6daa372abac9fa468c34b8294d0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2175fd51d52f438f0d3321bd7705501b84d9e96194ac611bcda00d29fb730010" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e97ebcb86bb452549788b303e382e927fd5b538f4be97f34072e9a19de8c1e87" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e260101ec45a1c2fa22494bb404a8c7bfbd5f2108ae303b1d8d158f8b50a110a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c1c9e44a0b225e2a825d1f49663d5504249b2937a4f9c7bb88fd2a8d7ead61a2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c3605f4dcc02d939c20521427964d7990d4a0d6de995bb16015029d557ed5b30" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f08c32bb3ba30ef34cd95c38dd07de858c1d9bbd0522f7436fdcaec3eb2be7c6" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ca496fb7b90e4a2db5bb25a555cc159344ff95ff71066b5d76173ed973530508" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f2dc1a778e582b6909962a9b4af40b5ac8038737d58b53852f2e83990622ff15" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7742a9df6846362c803da6ec4fee95e6ed964720766bf74e7c4c19cc78139338" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d0c41c764aae2a2e095bebb54542e6307aa50dfeb148e39b77855c4c8db29226" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c288b57f79c4fc97abb71d1be3984def9a0d1ca585683e9a32daa7fa4c21611e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3e4b9b7f43a8ec80c5252d73645a36e695f3e433e596d79a7796785aa76c20ba" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d689354ff76a93b727adbba2006f4e9996f119eb964bcab41093da496bd0e2ef" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="042eedaf191954a5ebe1c57d5b85c4a4d1bc3911602a6b1ee4b623935e9a1db4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cea0cda7c1407d3c7f4fdff00d3eeb23382a5f3eeb07bf10bce0a0d9c101810c" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="76d788fe860bc13678b341d1131cb32ca15cdec5975084a9d1e9941e1fd2b47b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b4a6df7d495b0f513140410b8bc7596a6b6afaa9516300e9dea867693de819bc" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="64444f257077391f0de3b2dcbe443f64c2c05a4504ea2bfff578c3263a458cdb" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f3abe3683a5f010c5cc55c1b048022af415016a7521c138eaddf10071e864dee" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6060d770e2643457766ecaa275494eb6bfa9abfd695c9fd4af1f2b8217555a65" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="698492ade4231f4ba3a2713dfa760c061fb57e8264c30eb9d76485a8e0e66e91" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f82bca3ef5742320b0b6e8725f3ea887d4edd3136c2dbcfaa57d79e79a638e94" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c9a8bc1717562547e8b0ac4061282d41815245b0e4a8979ac8889813c52e6972" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="810f8e8b41f782f9d10566300ca6cf746cb2b4e6a1881153c7974d3163d00094" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="549d91ab65c90dc3b4317bcb26f358c48360405b45e3f16174e0c535a475df68" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5dd8892c2b52e0294b4931bffa9899ef9e5506a7b156310549703568d9e6cdd0" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ce819aefd6f270f576ceb104c86b2ed09e58ae6b49bebe544175d6294965a174" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a765ac57e136fca89d280fe665cd43ba21f3e4415c411659a58112407adf76a2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2734f2a13babe988976e7c4abf1b2f4354439ab4e3eab70e71f11b4080f122f4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="edd5d7f2563492373cbc4050ea2289d580977c3c748b9788f2d37ef7cf91c7b6" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="af7d3607ba7ad62d377c97a206a0710f373908ca09255e9b544eb744b14f9b5c" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b325f94b281182a22956910181b54c9c924962eafa56b223fa03df8404f3b4fa" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="55e9c86a3cf12448cbb3d1ad174cc8676b4e7b325f3dcd3297a1fef5d41254f6" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="109acce94f9aefa4256510124300624a08ddaaf80f7a1b409ad25db8de79be36" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3858328329c1e1ae3df237d9535af5a6b7d961fbbc71d4f14f30da7ad01412eb" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="69aea6431299af2885e4a12fe9eac8b217668d92ab4853345677c640da00083a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="60e4de3c364c63f252f5c9e8dbcdee91e967bcbea6b3edf760e9165083ee57e4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="519b2ac03a0cf6a1bb39390d19c875482e77957f7d816d4dbde616e82657c63e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c59c87d919c86755fc7cbbde011326f0fd172556a001a3ab9537d10a5d6f594d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="82a091298f82f487ab775aca17fe1f7c4397c7e9dc3349df2d083355471985e3" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2e4abf515a0280b352b69862186567ddcefb5b60cb11eef4d67409f59e8884a9" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c80f52d8904e177de51dd01e529d20907f43427507bb2a7bcd159cfd5429b8e1" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9fce31e1654cca9ab4fd4116f4533462024821169fcd8f660b5eaa6110052226" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e29ba3fb6b69146c8107b530756422c59a431d659362a8e634795f8c264a8fae" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d9fc8dfabaf4ba1abb101464a1c61eeb2126cc6fa6f23f2731e677c1e8563ce7" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="84821ccf65f990a15917423dd7a9d200a2a53b1d002e80263771e1236a414526" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8e8aa8e7e1fbc77c141177595040003dfc1b597491c128f8ddd7ba13e41d8d94" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f85bcdfc1b5c87cccd58ac82e4e06e16f257a7ca8859e926d4f4184de2198c1a" name="flightctl-otel-collector" arch="aarch64">
  <version epoch="0" ver="0.10.0~main~81~g6efe8999" rel="1.20250812173346517456.main.81.g6efe8999.fc43"/>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.0.1-5" date="1724241600">- Add must-gather script to provide a simple mechanism to collect agent debug</changelog>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.3.0-1" date="1730721600">- Move the Release field to -1 so we avoid auto generating packages
  with -5 all the time.</changelog>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.4.0-1" date="1738929600">- Add selinux support for console pty access</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-1" date="1743422400">- Add services sub-package for installation of containerized flightctl services</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.6.0-2" date="1743681600">- Add sos report plugin support</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.10.0~main~81~g6efe8999-1.20250812173346517456.main.81.g6efe8999" date="1755000000">- EDM-1992: Agent SystemInfo smart collection (#1526) (kkyrazis)
- EDM-1476: add Events validation TCs (amalykhi)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-1821: test pass (Asaf Ben Natan)
- EDM-1821: added monitoring validation (Asaf Ben Natan)
- EDM-1993: Add restart configuration and polling for generated certificate files (Dakota Crowder)
- NO-ISSUE: publisher: call stop() before wg.Done() to fix flaky cancellation test (#1524) (Ilya)
- NO-ISSUE: Fix broken link in docs (Avishay Traeger)
- EDM-1987: Disallow label updates for owned fleets (Avishay Traeger)
- EDM-1712: fixed stuff based on PR reviews (Asaf Ben Natan)
- EDM-1712: Migrate HTTP metrics to OTEL (#1489) (Siddarth Royapally)
- EDM-1712: added tests renamed to domain metrics (asafbss)
- EDM-1845: signer refactoring: avoid parsing CSR multiple times, decouple from API layer (Ilya)
- EDM-1938: agent/dependency: ensure partial layer pull cleanup (Sam Batschelet)
- EDM-1818: Prefetch Manager Config Docs (#1514) (kkyrazis)
- EDM-1058: docs/user: add TPM related docs (Sam Batschelet)
- EDM-1058: internal/agent: small TPM api update (Sam Batschelet)
- EDM-1058: internal/service: refactor TPM csr logic (Sam Batschelet)
- EDM-1058: internal/tpm: ensure chain validaition (Sam Batschelet)
- NO-ISSUE: Event fixes (Avishay Traeger)
- EDM-1170: Fix Makefile (#1490) (Siddarth Royapally)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-799:Decommission test CLI (Samuel de la Cruz)
- EDM-1946: labels endpoint with field-selector=metadata.labels returns error 400 (#1495) (noga-magen)
- EDM-1058: internal/tpm: ensure conditions are maintained during approval (Sam Batschelet)
- EDM-1058: Fix simulator tests and flush key bug (Kyle Kyrazis)
- EDM-1058: Testing TPM Ownership Auth (Kyle Kyrazis)
- EDM-1058: Implement TPM-rooted device identities (Sam Batschelet)
- EDM-1869: Add missing events (Avishay Traeger)
- NO-ISSUE: reverting EDM-1871 (noga-magen)
- EDM-626: Add Git support for test harness (#1328) (Siddarth Royapally)
- EDM-1958: Fix Device UpdateStatus event panics (#1482) (kkyrazis)
- NO-ISSUE: Add io.openshift.tags to db-setup container (#1486) (Assaf Albo)
- EDM-1170: Auto-discover VM IP for agent updates (#1393) (Siddarth Royapally)
- EDM-1845: middleware agent cert OrgID support (#1471) (Ilya)
- NO-ISSUE: no need to keep rpms in gh-pages (#1477) (Gregory Shilin)
- EDM-1952: Add middlewares alertmanager proxy (Avishay Traeger)
- EDM-1838: deny DELETE ER  when device exists (#1415) (Ilya)
- NO-ISSUE: fix version generation for COPR for release (#1468) (Gregory Shilin)
- EDM-1944: setting Enforcing selinux in microshift registartion E2E test (sserafin)
- EDM-1942: Redact passwords when config is logged (Dakota Crowder)
- EDM-1936: Fix Router group order to make auth/validate reachable (rawagner)
- EDM-1846: orgs cli support (#1424) (Ilya)
- NO-ISSUE: Add VM_DISK_SIZE_INC to set the disk size increment in vm (Itzik Brown)
- EDM-1766: Small SELinux Related Tweaks (Ben Keith)</changelog>
</package>
<package pkgid="0e2788586f187441d1cf29a9db39f02936b93d4d802112f1b2588dbe0a539db2" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f642f5dd83f97e787e12bbd96c30feade5a40dd56b7291f63d21d04b05da06bd" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f41216fa7e0996d10ce9e301fd44efa59f8d7a1ff8096c278403cbd6a902aa8b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6b53dc9a6215851efa1a80eee871e3dafb82463407946d35a3b1c8fefda082b0" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b90dadc6dbc78370a52924db5a86fb99116e756f614be16e6e150c9a56028ee7" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="983d8a394b7dea5081178696e895eb0c7cd4b0b1735e5625cc53dbff22b8b002" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7245fa78323abfc12b1e32db80f9f215cf1e398e84c362a70895baa6edadc32a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fbd004c5c18a78376e05d3f8580e8d49478a22206818a721972cd5b6f422691a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4581739f23e5422e124a1479edb4b95d232d24c190e9a0f521c72fdf8e231102" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="658a5e39de5838b121e1f414b97dd37dfad7bf39dff8f27cb9d1ec84e410e95f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5dfc14a7b3e1e2c8aad705ce7081250b675ee92c517043fc9b33437620a7f290" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ed59050a32b4f28c0628ba13a2c312aadb6fff0918cb433adda7a404e4b642a9" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bb7d32bcf96582b99120bde703235778466ddd4151d74a0a3b3a5fdb541d1a8f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="029af81a93a92889c10e0b5e406ab7ceeae1dc612dd34c2672b3d528112cf281" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9a86cdbee50e04d08f6c4157e978d0fbb0269fe2a1cd00c55bf32d8f6badcf00" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="904d9c0a9cf256461c52ce7c8c54a4470b694def893e23ab094d5deb366e4669" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d094d7bf41bb64328c575b3660edf8ee6bd00e407fd1b4efcd06ad6a0a74c951" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a824bc5fc26927533043b06584013c35dba9acd92b5b9bd874cb78fcadb39235" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="804de53e231cb3ab407e39980047b93c7a982ed757100377eb743e012605dcb4" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7eeebb65f73d45d2403e6a6b8b7b22c8452c6302c0317af2463eb6e8e7063b51" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4969057909013b31a15b5e33029ee452c8a62530d4192b83b14c8339ecb98d84" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d3ffb577fae808e59bf2ed1e3d88eb6872200b7a64f32e625a721ca00b1c3988" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f18004abcdd66332a9a17921f94be61b07352cafb33e6ddfdef0e5728cc01f3e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0f42a8ae9c0845855d49cefe0d2c50ba32c7ef76b8dafae02adfb449d32f6cdb" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b74b7a07185a0b6cecf7441fa07de0a2ae875779ca3244c497eae0f64c24dd24" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cbde7b9fb3fd2dfd9bb55d27485eef5e8db6bf83ba46383c73e4c02ea02d156a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bfcfb0a87fb734aed5d8649f0aaa7adcbbcc57fe180610a9b0581d7b27ef798d" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1ea320c1ae2704aab6711eb361be5f02f99ff64579b7f480076d02cde1eb2b3e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e672e53ebaf03b5497fe650abac4fcb51499d6c6749df7f0f063824aae35c2ef" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3810a43d7b717cd60098a56cedabf26447f0bdee0a9fbb557f6babb1aa4ce979" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f48f004eec9a93fe83135a3053d1d7c4cf4ce4ee2acb5e4dc36de6eb22538b10" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e45f7d0498ea54f10df6a71879c2dc2378ad0f17305b7e13da17b59e5ffbed35" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5db1290362ee3fa55420e6078820e2bca89ef9cd4c28bf5997e1eb3b356dceb3" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e81e8cc48213d95a94004d2c430a9722a4d741b3138e830103b317ad4bab692f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2373158f9d21727e20191a4bd93c6e3385b487c589b06fc86256848f539946dc" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="261bda9305a3ce9859d3c6d464af35b9b03d7f33dee7bdbcecfc0b29dcb0e6f4" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c388857dfa80cb3c7fb2189e793c4f75ac2b867994646b697942f2702d4653e0" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bff8cb83756e202c1f04eb430dcf033c8499424216289d47baf51edf0f65e3c6" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="fb603be60b5d020b0df23cee525ab14e444178bde35d1f0877726ddd0788ad4d" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4a3cf9bf99565dbade323e2517cd1b95f2ede7728d14bb5b7ee459375c0eaa92" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9e67a67c221734e479a640f0d3649a12b02b00d937f0c9f422c66b188da2f900" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bb053dad90883123e9d9aa20ec4eec07ef16a130dac0f61afbfbe60981064931" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6c78c568c722d781863216ce0e7dda5b4df3326e9971a9095e8285e790369a78" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e40ce360834bf06ecaab99b1bb40faef857054e33f3e05aec32568440b21e6f6" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a67e7253e13e9576d02a12eae6c65ed044b4089227709dd601c4e328e9ee71d4" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="832734771d187f53cafb7c5483aefd7327a7b55e9a6f550257462741c879af03" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a69967b2d967fa02f79069a998c34ec8d342251427ed72488ba8e4da06653cb5" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="12ae351dda375533dc27b6db7fd8c31bd44d2ff46b59c8c1c2cfff90da800359" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2b226b3fde12b31a524611a89c2791a8fee8da802e8ffeab3848fced5107e38b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="559797991e43f97d72a8ebfba0fbc022ee00efe6fa31900d5adc49e061a92e6f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e607d437f943b03fa7b596f1879fe2fc731d88dee96c7fe0964359368f418b5f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5339eb4198b7bf5e43f4b3d84b4850bfbfee60cd12bc844316052e57d29c2b38" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="81395187a1e3e1c4e185cb8a4a3032ad263afe846bc304d120efb6a80b3a2d71" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="75ae26ee68f58c4bc780c703138be0dd8263d1b470ae9f8e37b11c5c3410ed09" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="864facae8591059aed6214b38a0cab96d9f2e5a918477849ab4ddc95cb88b783" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="40d0df61f170a3b2c79e6f92a3b54979cc3411b11281815384c47d0981208d7a" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5e40e8aa00157f17f4581089c18f4b2e31a6e0585c3695a4c4e4a4c9edc30666" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="415785dc5fc6e498a017e45b56f945c0ae942ce240c0ab894ce6f6e441bda9f6" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b1c9e20ca17b071ecf8f4633b545b7e6f2e3a0c699f1bb23e2ae2fe3f7cfa1e9" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ab30cebf7d03757b138b8547d38703c5a83b56667d106d0716754c6cd57ee769" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="98d855c3a6213301ffe14d6713cb11ae597d10de706157157a96f39f0a2ee0a8" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3009affb289d02285df50f2a83c982eddc2ad0b94c72de35922455fd1bda95bc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="99b30fcd2d7206d6e50372a6a8ecf7f8e408bf92bcd63d80c7096677462c20dd" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6f03103caa4b603bf003532be9553b20aa8062db2555618509dbbace58e9aacc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0c12dd9592cb47c1691100d4e69a6396de68f906b40100fcd3416c95a43a388c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4436686beb282c9e90ecd9be4fb13452503671446fa4fbdffecf59ea8a0d8a43" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="05d825adb935340219a0b3726a0981843d524c5edcd3c26bef8858f3e7e14b05" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b981c6227b2ee08bd9a3052781ad7a745c0c2617002bae093980b9af4aca323d" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1dda5d522000f9c43a41e0cb73182af729d662475160c88941a1c32bfde734a1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ae776760596553010241db59c3b2f7741bfabc0712ae79b2da47cc46a89b2673" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="075ffc48550376ba45197d6edf208ea9c33385ab2011f70019a5656447ddf7b8" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="93bddb9fda9183ef7bdc0c8fd9895de4777c7713a767f4215efc0bd1f19bf88b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e78777f50004deef44b1cba166a658c9f6a1518b302d6bf716c9ca4a70e065c0" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="396caeafabefe171c8f1b5326c5cb7d3188984059511cb88e55a5d1ff734443e" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1a0cec2935cf18e6e433e9a688c651d169ff146af6ed03e1512ea8a195feda5f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5cbdc0457620a81038df9c8e567ab614760805a99f677ece0dd5610af31e1f8e" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8a7fedc23947258fbc1e83d3038e733c544cb7c7c59eb112379e0b84968392c1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6f4276fb93e1621401871dadfe25ffbe1f450e20b7cc9f703478ced8ca4982b2" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="48fda21bc3eab2ed4e23506701b5c7f3f4ab78422edb58b6af91c024e31ab8f1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ac432fb7b462026acc942f5276ddfe82dd94a8715101f692dc2f90ecd38842b9" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6d20387a64de7179a60c2ea9d41a901d840dd4c6ff56e797605743b8df9627b3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2b4e0e9f4d88debcf4cd1394b6f7d1e6813a9bd4b7c6bfe05e85f3ddf1ca2d8d" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="22242631e069a1cdfb63cd3a227689440a0f3d6f59979f441fe027bc0fa41a44" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f59abde4e09574e27ea66d5c934ce2747e13260bf487db5280dec9dbde747867" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="72a177a15256145b3a8d22df1c85067fe6d89f5c7e06a78b185843357512e4dc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="014b29198d763c1d207f6b5a70fe09c1e51a529b19c9c9396fc42f3bd2631b80" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bb4fe1e49704fc7f4cc020764c3a59a52367cc3750a3235f77672fb8ba59c085" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2ee8a0dae1ab0e2c427a6ada3b50017231b5719dc40415804d67292a35252b63" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2adf2c75d780cdddf44e3b12ff05ff0825481ccd64d835ba24b39ac4b86f9bbf" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="242f0b66e8f95a22f6513cda8499ae4518592b917dbbd00ba71f74d9676a5535" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d204ee07590d0fb5a1d39e492039d88530464ce2836dddbceb2f886a76dd0ef3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e5385906a8c2aa0a1c8dfa3f2bfe775228684e5d1a08bf0c41a6b5beb689b6a3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a3aaac07cd1de4a3c0447c4abe1573ab855a3ed1a92b88c51e0ab5b6b8b8fa2c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a5fea8ad4f645473dc17c55bf6bdb49952c9498d8006b124b6389d864e4601a7" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9dfa7d11e34ef7b2cf75065992fa21cbd98446a04868fe30dd7d6e4408bd1848" name="flightctl-telemetry-gateway" arch="aarch64">
  <version epoch="0" ver="1.2.0~main~27~gb5c1b040" rel="1.20260204153358102810.main.27.gb5c1b040.fc43"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.2.0~main~27~gb5c1b040-1.20260204153358102810.main.27.gb5c1b040" date="1770206400">- NO-ISSUE: missing network policy for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Bump resourcesync e2e task timeout value (Dakota Crowder)
- NO-ISSUE: Add e2e harness setup without VMs and use for ResourceSync tests (Dakota Crowder)
- EDM-3265: build cs9 microshift image only if the repo is accessible (Ilya Skornyakov)
- EDM-3262: fixed cancel not working properly for pending states (Asaf Ben Natan)
- EDM-3263: when defaulting to HOST_FQDN -&gt; lowercase it (Asaf Ben Natan)
- EDM-3005: update ginkgo_total_nodes (Gregory Shilin)
- EDM-3005: update ginkgo_total_nodes to be 2 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Add cs10-specific error message support (Gregory Shilin)
- EDM-3005: Add running cs10-bootc e2e tests. Fix certificate handling (Gregory Shilin)
- NO-ISSUE: Disable rollback test temporarily (Ilya Skornyakov)
- NO-ISSUE: imagebuild api set to v1alpha1 (Asaf Ben Natan)
- EDM-3258: EDM-3257,operator cant cancel fix (Asaf Ben Natan)
- NO-ISSUE: fix Publish Binaries workflow (Ilya Skornyakov)
- EDM-2985: fix imports post-merge (Ilya Skornyakov)
- EDM-2985: add unit tests (Ilya Skornyakov)
- EDM-2985: validate header value (Ilya Skornyakov)
- EDM-2985: Add API version to HTTP request logs (Ilya Skornyakov)
- NO-ISSUE: repo url + entitlements support (Asaf Ben Natan)
- NO-ISSUE: Updated init container quadlet files to ensure everything in standardoutput and standarderror shows up in journal (Ram)
- NO-ISSUE: Add TC ID 87279 to greenboot rollback test (amalykhi)
- EDM-2636: Rootless Quadlets (Ben Keith)
- EDM-3226: fixes invalid chars attempted to be saved to psql (Asaf Ben Natan)
- EDM-6163: Skip kind test (Eldar Weiss)
- NO-ISSUE: MVC separation (Asaf Ben Natan)</changelog>
</package>
</otherdata>